https://community.splunk.com/t5/Splunk-Search/Splunk-stats-count-by-two-fields/m-p/569981#M198670 <P>Hi,</P><P>&nbsp;</P><P>Please try the following:<BR /><BR /></P><LI-CODE lang="markup">&lt;YOUR_QUERY&gt; | stats count by type, status</LI-CODE> Thu, 07 Oct 2021 05:16:10 GMT danielcj 2021-10-07T05:16:10Z https://community.splunk.com/t5/Splunk-Search/Splunk-stats-count-by-two-fields/m-p/569979#M198669 <P>Hi&nbsp;</P><P>Can anyone please help with this extracting stats count by two fields.&nbsp;</P><P>I've below data in each transaction</P><P>type&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; status</P><P>A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 200</P><P>B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 400</P><P>C&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 200</P><P>B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 200</P><P>A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 200</P><P>B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 400</P><P>A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 500</P><P>C&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 300</P><P>&nbsp;</P><P>I need stats in below format</P><P>type&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; status&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;count</P><P>A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 200&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;2</P><P>A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;500&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 1</P><P>B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 200&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1</P><P>B&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;400&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;</P><P>C&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;200&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1&nbsp;</P><P>C&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;300&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;1&nbsp;</P><P>&nbsp;</P> Thu, 07 Oct 2021 04:21:55 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-stats-count-by-two-fields/m-p/569979#M198669 srujan594 2021-10-07T04:21:55Z https://community.splunk.com/t5/Splunk-Search/Splunk-stats-count-by-two-fields/m-p/569981#M198670 <P>Hi,</P><P>&nbsp;</P><P>Please try the following:<BR /><BR /></P><LI-CODE lang="markup">&lt;YOUR_QUERY&gt; | stats count by type, status</LI-CODE> Thu, 07 Oct 2021 05:16:10 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-stats-count-by-two-fields/m-p/569981#M198670 danielcj 2021-10-07T05:16:10Z